My Log

Discussion in 'adware, spyware & hijack cleaning' started by CarpiSam, Mar 28, 2004.

Thread Status:
Not open for further replies.
  1. CarpiSam

    CarpiSam Guest

    I use spybot and then i use hijackthis to scan my system.

    My IE start page always change to "searchcentral.cc" although i have change to another.

    Thanks a lot

    Logfile of HijackThis v1.97.7
    Scan saved at 上午 10:19:37, on 2004/3/29
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    D:\PROGRA~1\SERV-U\SERVUD~1.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe
    D:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
    D:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
    D:\Program Files\D-Tools\daemon.exe
    D:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
    D:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
    D:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
    D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    D:\Program Files\Logitech\iTouch\iTouch.exe
    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
    D:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    D:\PROGRA~1\ICQ\ICQ.exe
    C:\Documents and Settings\carpisam\桌面\hijackthis1977\HijackThis.exe
    D:\PROGRA~1\ICQ\ICQSRP.exe

    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {10828e00-f6bd-45c0-9858-4e15dffa5752} - C:\DOCUME~1\carpisam\APPLIC~1\tfrroaeecky.dll (file missing)
    O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\Program Files\FlashGet\jccatch.dll
    O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - (no file)
    O3 - Toolbar: o_O?? - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: reaagroaiec - {ffe0e947-60a7-47df-a486-8c60c50bb957} - C:\DOCUME~1\carpisam\APPLIC~1\tfrroaeecky.dll (file missing)
    O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [pccguide.exe] "D:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
    O4 - HKLM\..\Run: [PCCClient.exe] "D:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
    O4 - HKLM\..\Run: [Pop3trap.exe] "D:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
    O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [zBrowser Launcher] D:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\System32\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Mirabilis ICQ] D:\PROGRA~1\ICQ\ICQNet.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
    O4 - HKLM\..\RunOnce: [tlc] C:\WINDOWS\update12.js
    O4 - Startup: .appletviewer
    O4 - Startup: .asadminprefs
    O4 - Startup: .plugin140.trace
    O4 - Startup: com_securenetasia_p11wrapper2.dll
    O4 - Startup: NTUSER.DAT
    O4 - Startup: NTUSER.DAT.LOG
    O4 - Startup: ntuser.ini
    O4 - Startup: plugin131_02.trace
    O4 - Startup: plugin131_06.trace
    O4 - Startup: SCLSk.bet_hongkongjockeyclub_com
    O4 - Startup: Setup.exe
    O4 - Startup: tnsa.bet_hongkongjockeyclub_com.cfg
    O8 - Extra context menu item: Download All by FlashGet - D:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: Download using FlashGet - D:\Program Files\FlashGet\jc_link.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
    O9 - Extra button: ICQ Pro (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: FlashGet (HKLM)
    O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
    O9 - Extra button: Yahoo! Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
    O16 - DPF: HKJC Applet - https://bet.hongkongjockeyclub.com/ib/ch/HKJC.cab
    O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
    O16 - DPF: Yahoo! MahJong - http://download.games.yahoo.com/games/clients/y/ot0_x.cab
    O16 - DPF: Yahoo! MahJong Solitaire - http://download.games.yahoo.com/games/clients/y/mjst3_x.cab
    O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
    O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
    O16 - DPF: {0F706A25-2496-4746-8589-74CFE4213760} (XBeat.XBeatCtl) - http://storage.18x.cx/XBeat.CAB
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {23B7A816-3647-49D2-9756-6F41CE8F9201} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/ddm_control.CAB
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/148273ea21865580c616/netzip/RdxIE601.cab
    O16 - DPF: {596546D4-3213-4376-923E-3251CFA2511E} - http://210.188.252.101/html/exe/XBokkori.CAB
    O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptemplates/ActiveSecurity.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37989.3501388889
    O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://nprotect1.gravity.co.kr/nprotect/npx.cab
    O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E56347B0-6C2B-4C2E-939F-EE513EAC80BC} (Creative Product Registration ActiveX Control Module) - http://www.creative.com/register/OCXs/CtORWebClientNoMFC.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{FE2BEFC4-4A94-4BFA-8172-31DE0FA426E2}: NameServer = 203.99.142.8,203.99.142.9
     
  2. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    4,451
    Location:
    North Carolina, USA
    Hi CarpiSam,

    Welcome to Wilders.

    Check the following items in HijackThis.
    Close all windows except HijackThis and click Fix checked:

    O2 - BHO: (no name) - {10828e00-f6bd-45c0-9858-4e15dffa5752} - C:\DOCUME~1\carpisam\APPLIC~1\tfrroaeecky.dll (file missing)

    O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - (no file)

    O3 - Toolbar: reaagroaiec - {ffe0e947-60a7-47df-a486-8c60c50bb957} - C:\DOCUME~1\carpisam\APPLIC~1\tfrroaeecky.dll (file missing)

    O4 - HKLM\..\RunOnce: [tlc] C:\WINDOWS\update12.js

    O16 - DPF: {23B7A816-3647-49D2-9756-6F41CE8F9201} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/ddm_control.CAB

    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/148273ea21865580c616/netzip/RdxIE601.cab

    O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://nprotect1.gravity.co.kr/nprotect/npx.cab

    And do you know what these are?

    O4 - Startup: .appletviewer
    O4 - Startup: .asadminprefs
    O4 - Startup: .plugin140.trace
    O4 - Startup: com_securenetasia_p11wrapper2.dll
    O4 - Startup: NTUSER.DAT
    O4 - Startup: NTUSER.DAT.LOG
    O4 - Startup: ntuser.ini
    O4 - Startup: plugin131_02.trace
    O4 - Startup: plugin131_06.trace
    O4 - Startup: SCLSk.bet_hongkongjockeyclub_com
    O4 - Startup: Setup.exe
    O4 - Startup: tnsa.bet_hongkongjockeyclub_com.cfg

    Download CWShredder and run. Be sure ALL other windows are closed use the Fix button and follow the instructions you will receive.

    Then reboot in Safe Mode and delete the following:

    C:\WINDOWS\update12.js

    I also urge you to update your copy of Windows by going HERE. This will help cut down on your chances of reinfestation.

    Reboot and then post a fresh HijackThis log.

    Regards,
    Kent
     
Thread Status:
Not open for further replies.